blob: abbe5c6000e3ce82c9eb9f7f0241c6b3d6143b28 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
jsaccess - download and decrypt files in the browser
2013, Laurent Ghigonis <laurent@gouloum.fr>
Provide protected access to files on a web server without htaccess or https.
The files are stored AES256 encrypted on the server, and decrypted on download
in the web browser.
You should still use https to protect against client targeted attacks like
mitm on the javascript code or mitm on the encrypted archives.
$ git clone git://git.zx2c4.com/laurent-tools
$ cd laurent-tools/jsaccess/
$ firefox jsa/index.html
demo password is 'jsa'
Deployment
==========
First, put jsa/ directory on your web server, publicly available
To add a file for others to download :
1. $ ./encrypt.sh myfile
Then enter the passphase you want to use for encryption.
It will tell you something like:
jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0
CREATED jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0/065e18a7f246b800242a778a6e8dd07a3321dac6
UPDATED jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0/index.txt
2. Upload both CREATED and UPDATED files to your server
You need to keep the correct full path
$ rsync jsa/ user@_host:/var/www/htdocs/
3. Direct people to the directory jsa/, e.g. http://myserver.com/jsa/
Example adding a new file
=========================
$ ./encrypt.sh README.txt
Enter passphrase used to encrypt: jsa
jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0
CREATED jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0/065e18a7f246b800242a778a6e8dd07a3321dac6
UPDATED jsa/files/af022cd820fdad6cbcac8e15ac565c639a47dab0/index.txt
$ rsync jsa/ user@_host:/var/www/htdocs/
Example downloading a file
==========================
firefox jsa/index.html
# enter 'jsa' as password
# click on 'Get files list'
# select 'README.txt'
# click on Download
# you now have the file decrypted :)
How it works
============
encrypt.sh creates a directory jsa/files/<rmd160_hash_of_passphrase>/.
It encrypts your file using AES256 with the passphrase and stores the result in
jsa/files/<rmd160_hash_of_passphrase>/<rmd160_hash_of_(passphrase+filename)>.
It also updates the index of available files per directory called index.txt,
that contains real file names. The index is also encrypted using AES256 with the
passphrase.
Web UI generates rmd160 hash from the passphrase and get the list of files
available for this passphrase (jsa/files/<rmd160_hash_of_passphrase>/index.txt),
decrypts it and shows the list of files.
When the user clicks on Download, it fetches the file from the rmd160 name,
decrypts it with the passphrase and stores it with the real name using the
Filesaver JS API.
Git content
===========
jsa/ - should be on your webserver, can be renamed
jsa/files/<password_hash>/ - directory of files to download for a given password
jsa/files/<password_hash>/index.txt - list of file name available
encrypt.sh - to encrypt your files before uploading them to your web server
TODO
====
* Download progress
* Decrypting progress
Need to modify gibberish-aes
|
